AMI - Amazon Machine Image

7. AMI In Production

Okay, so just a short theory lesson on how to use Amis in production. So there is a way for you to force users to only launch two instances from pre approved Amis. And what is a pre-approved AMI? Well, it's an AMI that you're going to tag with a specific tag. And then when you combine this with an im policy, then you restrict a user to only launching, for example, Amis that have been tagged with the environment prod. So let's say, for example, we have a user with appropriate im permissions. As you can see, it's a condition that we apply to the user. And so now we have two types of AMI in our accounts. We have the not approved, the non-approved MI, which are the ones that don't have tags, and the AI that has been approved has been correctly tagged for environmental proc. So, obviously, you need to restrict who can add tags to your Amis.

But then, thanks to this combination of tags and I am policy, the user is not going to be able to launch an instance from a not approved mi and is going to be allowed to launch an AMI from an approved mi. And that's for number one. So this is to prevent Amis from being launched if they're not approved. But the second thing is that you can have AWS config to find noncompliance and two instances that are easy to instance that have been launched using Amis that were not approved before. So let's take an example. A user discovered a way to launch two instances, one from an approved AMI and one from an unapproved AMI. In this case, using conflate, we can write a rule that's going to monitor all these two instances and find out if the issue instances are compliant or not. And the ones that are used that are not compliant will be flagged by config and then we can take actions. The ones that are compliant will be marked green and we're good to go. So that's such a sort of theory lecture, but it's a way to see how you can have a production ready set up for your mis. I will see you in the next lecture.

8. AMI Section Cleanup

In order to clean out that section, take your instance and terminate it. OK? And also, if you wanted to terminate, delete your account so you can take that demo image and deregister it, which should remove the AMA. OK And on the back end, a snapshot is being created. You go to the snapshots, which is the snapshot that was back in my AMI. You can delete the snapshots and you'll be good to go. So that's it for the cleanup of the AMI section. I hope you liked it and I will see you in the next section.

Managing EC2 at Scale - Systems Manager (SSM) & Opswork

1. Section Introduction

Now that we know all there is to know about EC Two, it is time for us to understand how to manage EC Two instances at scale. And for this, this is going to be around Systems Manager and Upsworth. As a result, this section is quite large. We will learn about SSM from an exam perspective. But I also wanted to the real world, so we'll go a little bit beyond because I think SSM is a tremendous service. So we'll learn how to manage a fleet of EC2 instances and on-premise servers using SSM, how we can apply patches at scale, how we can run automation and create secure shelves, and how we can store parameters. And finally, for app work, we'll get back to using Chef and puppet. I hope you're excited. Let's get started.

2. Systems Manager Overview

So now let's discuss a service that will come up in the exam, which is the Systems Manager service. So this helps you manage a fleet of Easy Two instances and on-premises servers at scale. And this is going to be a suite of tools. And there are so many tools like Systems Manager that will give you insight into the state of your infrastructure. It allows you to easily detect problems and also gives you some patching automation and enhanced compliance. This is something that comes up at the exam a lot whenever you need to patch your instances. Usually it's going to be done with Systems Manager or any kind of automation you'll be running. also be using Systems Manager.

So it works on both Windows and Exos, and it will be fully integrated with Cloud Watch Metrics and Dashboards, as well as Config. And it's a free service; you're only going to pay for the resources they use or create if it does anything like that. There are so many features in System Manager. And do not be afraid of what I'm going to say, but there are resource groups: apprentice management, Explorer, app center, cloud dashboard, PhD, and Incident Manager. You have the Shared Resources menu with documents in it. Then change management for change manager automation change calendar maintenance windows There's application management for application manager, app config, and the parameter store. And finally, node management for fleet manager compliance inventory hybrid activation session. Execute the state Manager batch Manager distributor command. So you may be very afraid right now and you're saying, how the hell would I know all these things? The good news is you don't need to know all these things. In blue is what I will highlight in this course, which I think are important features of Systems Manager you need to know going into the exam, so we'll know them at a high level. Again, to be an expert in all of them. However, Systems Manager is subject to significant change over time. A lot of features have been added or are being added to the service over time.

So if this list is not up-to-date, do not worry. And also, if, for example, tomorrow Fleet Manager becomes a service that you need to know going to the exam, I’m not going to change that lecture, okay? But I'm going to add Fleet Manager to the section and you will learn about it as well. So now if I go into the SSM service just to show you the menu, we are in it, and as you can see on the left hand side, we have all these options that you can see right here. It knows how to change the structure of them as well over time. So it's not a given that one will be here and not move here at some point. Okay? But do not worry. I will spend some time going over the most important ones, and they should make sense to you. Now how does SSM work? So we need to install the SSM agent onto the systems we want to control at a high level. Okay? And this is an agent that comes packaged with Amazon Linux Two AMI. This is why we love using the Amazon Two AMI and also some Umbundu, a Mi. If your instance cannot be controlled with SSM, it's probably an issue with the agent or the I’m permissions. OK? And if your AMI does not have these agents on it, it's as simple as running a few commands to install that agent.

So we're going to have EC two instances with the SSM agent running or an on-premises server or VM with an SSM agent running and then automatically, after the correct configuration and making sure that these have enough information to talk to the Systems Manager service, the instance will be connected and then Systems Manager can operate all the kinds of features I just told you about on the instances to perform, for example. Some compliance, some patching, some automation. Okay? So if there's an issue with an instance not being registered into SSM, you either have to look at the SSM agents not running or not working correctly or make sure that these two instances have the right role to perform actions on SSM. So in the next lecture, what I'm going to do is go ahead and set up three EC2 instances with the SSMagents and register them into Systems Managers. So I will see you in the next lecture.

3. Start EC2 Instances with SSM Agent

Okay, so let's go ahead and launch Easy to instances. So they will appear in Systems Manager and, for this reason, we want them to appear under our FleetManager, which is a way for us to see which instances have been registered. And so what we need to do is to complete the SSM Agent installation and then it would appear uld appear So right now, as you can see, we have zero managed instances in Fleet Manager. But let's go into services. I'll go under Et Two and I'm going to launch an instance. I will choose the Amazon Linux Two AMI and I've typed it to my crowd to remain within the free tier, and I will launch three instances. Okay? And when we do this, we're then going to be launched in the same availability zone. That's fine. And for my role, this is very important. We need to create an I role that will allow this Easy Two instance to talk to the Systems Manager service. So to do so, what I'm going to do is click on "Im Role" and create a new Im Role.

So create a role for two easy instances. Next permissions and in the policy, I will look for a managed policy named Amazon Easy to Roll for SSM. And this policy contains, if we look at the summary, enough permission to write to the Systems Manager service to register the instance with it. So let's select this Amazon easy to roll for SSM. Click on Next Tags for the next review and I will call this one Amazon Easy to Roll for SSM. great. Let's create this role and we're going to leverage this role. So I will refresh. And now we have this Amazon X two-row for SSM. And so this role, combined with the AMI we have chosen so far, which is the Amazon X Two Mi, will allow us to see our instance in Systems Manager because the AmazonLinux Two AMI contains the SSM Agent already configured and will try to launch at boot time as well. So at storage, good to go at tags, configure security group and here I'm going to create a new security group. I will call it SSNG and I will keep the description right here and I will remove the SSH rule right here and I will show you why later on. So currently, our instances cannot be accessed using SSH. We're doing a launch launch and I will use this key pair to launch my instances. So now if we go into our services and we look at the three of them, they're pending right now in the pending state, and then they're going to be launched, and then after being launched, we should see them in the managed instance.

So I'm going to pause the video until this happens. So my instances are now running and they've been running for a while, and if I go back to my Fleet Manager now and I will just refresh this, as we can see,my three instances are now managed by Fleet Manager and we can see the operating system is Amazon Linux. We can see the SSM Agent version as well as the Agent Pink status, which is online. As you can see, this is not Fleet Manageraccessing our EC two instances because we have closed all the security ports for inbound rules. This is instead the Amazon SSM Agent that is reaching out to the Fleet Manager service to be registered. So it's pretty cool, as you can see. Now we have three instances registered in SSM. That means we can start operating some pretty cool operations with the features. So I will see you in the next lecture.

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap AWS Certified SysOps Administrator - Associate (SOA-C02) certification video training course that goes in line with the corresponding Amazon AWS Certified SysOps Administrator - Associate exam dumps, study guide, and practice test questions & answers.